The NotPetya Outbreak

Mohammad Tabbara, senior systems engineer, UAE and Channel, Infoblox, discusses the recent ransomware attack and how channel partners can help customers to stay on top of their cybersecurity solutions.

Barely after the dust has settled on WannaCry, the ransomware that affected hundreds of thousands of computers in 150 countries in May, another ransomware attack, NotPetya, started infecting organisations across Europe and into the Americas on June 27, 2017. Initially, this attack was thought to be a variant of Petya ransomware because the attackers crafted the malware to resemble Petya. Upon further analysis, it was discovered that the main distribution and payment schemes were not consistent with prior Petya campaigns.

Where prior Petya campaign operated an organised payment and decryption key distribution system accessed via the Tor network, this attack relied upon a single email account for coordinating ransom payments and decryption keys. That address was identified and deactivated early leading investigators to conclude it was unlikely attackers intended for it to remain operational through the duration of the campaign.

NotPetya was disseminated via the compromised software update service from MeDoc, a distributor of tax accounting software mandated by the Ukrainian government. The malware spread to more than 12,000 systems in Europe and the Americas. This new variant started spreading across networks using Windows Management Instrumentation Command-line (WMIC) or the Microsoft Server Message Block (SMB) exploit known as ETERNAL BLUE. The SMB exploit is the same method used by WannaCry ransomware, and Microsoft had already released a patch for the vulnerability.